<html><head><meta http-equiv="content-type" content="text/html; charset=utf-8"></head><body style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><br><div><blockquote type="cite"><div>On 20 Mar 2023, at 2:45 AM, Barry Smith <bsmith@petsc.dev> wrote:</div><br class="Apple-interchange-newline"><div><meta http-equiv="content-type" content="text/html; charset=utf-8"><div style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div><br></div> I found a bit more information in gmakefile.test which has the magic sauce used by make test to stop the firewall popups while running the test suite.<div><br></div><div><div># MACOS FIREWALL HANDLING</div><div># - if run with MACOS_FIREWALL=1</div><div># (automatically set in $PETSC_ARCH/lib/petsc/conf/petscvariables if configured --with-macos-firewall-rules),</div><div># ensure mpiexec and test executable is on firewall list</div><div>#</div><div>ifeq ($(MACOS_FIREWALL),1)</div><div>FW := /usr/libexec/ApplicationFirewall/socketfilterfw</div><div># There is no reliable realpath command in macOS without need for 3rd party tools like homebrew coreutils</div><div># Using Python's realpath seems like the most robust way here</div><div>realpath-py = $(shell $(PYTHON) -c 'import os, sys; print(os.path.realpath(sys.argv[1]))' $(1))</div><div>#</div><div>define macos-firewall-register</div><div> @APP=$(call realpath-py, $(1)); \</div><div> if ! sudo -n true 2>/dev/null; then printf "Asking for sudo password to add new firewall rule for\n $$APP\n"; fi; \</div><div> sudo $(FW) --remove $$APP --add $$APP --blockapp $$APP</div><div>endef</div><div>endif</div><div><br></div><div>and below. When building each executable it automatically calls socketfilterfw on that executable so it won't popup.</div><div><br></div><div>From this I think you can reverse engineer how to turn it off for your executables.</div><div><br></div><div>Perhaps PETSc's make ex1 etc should also apply this magic sauce, Pierre?</div></div></div></div></blockquote><div><br></div><div>This configure option was added in <a href="https://gitlab.com/petsc/petsc/-/merge_requests/3131">https://gitlab.com/petsc/petsc/-/merge_requests/3131</a> but it never worked on my machines.</div><div>I just tried again this morning a make check with MACOS_FIREWALL=1, it’s asking for my password to register MPICH in the firewall, but the popups are still appearing afterwards.</div><div>That’s why I’ve never used that configure option and why I’m not sure if I can trust this code from makefile.test, but I’m probably being paranoid.</div><div>Prior to Ventura, when I was running the test suite, I manually disabled the firewall <a href="https://support.apple.com/en-gb/guide/mac-help/mh11783/12.0/mac/12.0">https://support.apple.com/en-gb/guide/mac-help/mh11783/12.0/mac/12.0</a></div><div>Apple has done yet again Apple things, and even if you disable the firewall on Ventura (<a href="https://support.apple.com/en-gb/guide/mac-help/mh11783/13.0/mac/13.0">https://support.apple.com/en-gb/guide/mac-help/mh11783/13.0/mac/13.0</a>), the popups are still appearing.</div><div>Right now, I don’t have a solution, except for not using my machine while the test suite runs…</div><div>I don’t recall whether this has been mentioned by any of the other devs, but this is a completely harmless (though frustrating) message: MPI and/or PETSc cannot be used without an action from the user to allow others to get access to your machine.</div><div><br></div><div>Thanks,</div><div>Pierre</div><br><blockquote type="cite"><div><div style="overflow-wrap: break-word; -webkit-nbsp-mode: space; line-break: after-white-space;"><div><div><blockquote type="cite"><div>On Mar 19, 2023, at 8:10 PM, Amneet Bhalla <mail2amneet@gmail.com> wrote:</div><br class="Apple-interchange-newline"><div><div dir="ltr">This helped only during the configure stage, and not during the check stage and during executing the application built on PETSc. Do you think it is because I built mpich locally and not with PETSc?</div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sun, Mar 19, 2023 at 3:51 PM Barry Smith <<a href="mailto:bsmith@petsc.dev" target="_blank">bsmith@petsc.dev</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div style="line-break:after-white-space"><div><br></div><div> ./configure option with-macos-firewall-rules</div><div><br></div><div><br></div><div><blockquote type="cite"><div>On Mar 19, 2023, at 5:25 PM, Amneet Bhalla <<a href="mailto:mail2amneet@gmail.com" target="_blank">mail2amneet@gmail.com</a>> wrote:</div><br><div><div dir="ltr">Yes, this is MPI that is triggering the apple firewall. If I allow it it gets added to the allowed list (see the screenshot) and it does not trigger the firewall again. However, this needs to be done for all executables (there will be several main2d's in the list). Any way to suppress it for all executables linked to mpi in the first place?<div><br></div><div><span id="m_-8640580052742495038m_-2625297214711973251cid:ii_lffwpb3h0"><Screenshot 2023-03-19 at 2.19.53 PM.png></span><br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sun, Mar 19, 2023 at 11:01 AM Matthew Knepley <<a href="mailto:knepley@gmail.com" target="_blank">knepley@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div dir="ltr">On Sun, Mar 19, 2023 at 1:59 PM Amneet Bhalla <<a href="mailto:mail2amneet@gmail.com" target="_blank">mail2amneet@gmail.com</a>> wrote:<br></div><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir="ltr">I'm building PETSc without mpi (I built mpich v 4.1.1 locally). Here is the configure command line that I used:<div><br></div><div><div style="margin:0px;font-stretch:normal;font-size:18px;line-height:normal;font-family:Monaco;color:rgb(242,242,242);background-color:rgba(0,0,0,0.85)"><span style="font-variant-ligatures:no-common-ligatures">./configure --CC=mpicc --CXX=mpicxx --FC=mpif90 --PETSC_ARCH=darwin-dbg --with-debugging=1 --download-hypre=1 --with-x=0</span></div></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr"></div></div></blockquote><div><br></div><div>No, this uses MPI, it just does not built it. Configuring with --with-mpi=0 will shut off any use of MPI, which is what Satish thinks is bugging the firewall.</div><div><br></div><div> Thanks,</div><div><br></div><div> Matt</div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Sun, Mar 19, 2023 at 10:56 AM Satish Balay <<a href="mailto:balay@mcs.anl.gov" target="_blank">balay@mcs.anl.gov</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">I think its due to some of the system calls from MPI.<br>
<br>
You can verify this with a '--with-mpi=0' build.<br>
<br>
I wonder if there is a way to build mpich or openmpi - that doesn't trigger Apple's firewall..<br>
<br>
Satish<br>
<br>
On Sun, 19 Mar 2023, Amneet Bhalla wrote:<br>
<br>
> Hi Folks,<br>
> <br>
> I'm trying to build PETSc on MacOS Ventura (Apple M2) with hypre. I'm using<br>
> the latest version (v3.18.5). During the configure and make check stage I<br>
> get a request about accepting network connections. The configure and check<br>
> proceeds without my input but the dialog box stays in place. Please see the<br>
> screenshot. I'm wondering if it is benign or something to be concerned<br>
> about? Do I need to accept any network certificate to not see this dialog<br>
> box?<br>
> <br>
> Thanks,<br>
> <br>
> <br>
<br>
</blockquote></div><br clear="all"><div><br></div><span>-- </span><br><div dir="ltr"><div dir="ltr"><div>--Amneet <br><br></div><div><br></div><div><br></div></div></div>
</blockquote></div><br clear="all"><div><br></div><span>-- </span><br><div dir="ltr"><div dir="ltr"><div><div dir="ltr"><div><div dir="ltr"><div>What most experimenters take for granted before they begin their experiments is infinitely more interesting than any results to which their experiments lead.<br>-- Norbert Wiener</div><div><br></div><div><a href="http://www.cse.buffalo.edu/~knepley/" target="_blank">https://www.cse.buffalo.edu/~knepley/</a><br></div></div></div></div></div></div></div></div>
</blockquote></div><br clear="all"><div><br></div><span>-- </span><br><div dir="ltr"><div dir="ltr"><div>--Amneet <br><br></div><div><br></div><div><br></div></div></div>
</div></blockquote></div><br></div></blockquote></div><br clear="all"><div><br></div><span>-- </span><br><div dir="ltr"><div dir="ltr"><div>--Amneet <br><br></div><div><br></div><div><br></div></div></div>
</div></blockquote></div><br></div></div></div></blockquote></div><br></body></html>